Server Help

I recently realized users are able to access my base document root using opendir() and readdir()... I find this to be a big security risk.. I am wondering if anyone knows of any ways to limit it so that the user can only usephp on his level,and not be able to access any server files. I hope that makes sense, heh.. If you need more info,say say.. Oh,btw,its a unix server. -Andy L